open-vm-tools-clipway

maintainer el_aur · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The setuid chmod 7755 on vmware-user-suid-wrapper is standard practice for open-vm-tools (the official AUR package does the same), the source is built from the official VMware GitHub repo with a Wayland clipboard patch, and all checksums are provided; no remote code execution or exfiltration is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The setuid chmod 7755 on vmware-user-suid-wrapper is standard practice for open-vm-tools (the official AUR package does the same), the source is built from the official VMware GitHub repo with a Wayland clipboard patch, and all checksums are provided; no remote code execution or exfiltration is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:67 chmod 7755 "${pkgdir}"/usr/bin/vmware-user-suid-wrapper

PKGBUILD

1 offending line(s) highlighted

      1_pkgbase=open-vm-tools
    
      2pkgname=open-vm-tools-clipway
    
      3conflicts=('open-vm-tools' 'open-vm-tools-git')
    
      4provides=('open-vm-tools')
    
      5epoch=6
    
      6pkgver=13.1.0
    
      7pkgrel=2
    
      8pkgdesc='open-vm-tools for VMware with clipway patch (Wayland sessions clipboard fix)'
    
      9arch=('x86_64')
    
      10url='https://github.com/vmware/open-vm-tools'
    
      11license=('LGPL-2.1-only')
    
      12depends=('fuse3' 'icu' 'iproute2' 'libdnet' 'libmspack' 'libsigc++'
    
      13         'libxcrypt' 'libcrypt.so' 'libxss' 'lsb-release' 'procps-ng'
    
      14         'uriparser' 'which' 'xmlsec' 'wl-clipboard')
    
      15makedepends=('git' 'chrpath' 'doxygen' 'gtkmm3' 'libxtst' 'python' 'rpcsvc-proto' 'glib2-devel')
    
      16checkdepends=('cunit')
    
      17optdepends=('gtkmm3: DnD/CP plugin'
    
      18            'libxtst: DnD/CP, resolution set plugins'
    
      19            'netctl: suspend-resume network state'
    
      20            'networkmanager: suspend-resume network state')
    
      21backup=('etc/pam.d/vmtoolsd'
    
      22        'etc/vmware-tools/vgauth.conf'
    
      23        'etc/xdg/autostart/vmware-user.desktop')
    
      24options=('docs')
    
      25source=("git+https://github.com/vmware/open-vm-tools#tag=stable-${pkgver}"
    
      26        'vmtoolsd.pam'
    
      27        'vmtoolsd.service'
    
      28        'vmware-vmblock-fuse.service'
    
      29        clipway.patch
    
      30        open-vm-tools-gcc16.patch)
    
      31sha256sums=('916a09225a22653ec5e56b1df5bbfacc7f69b2b9e8ac734052936bcb75cde49a'
    
      32            '9848f4b621bb1134e463fea099f03933cf3f48f1ac5e580228abef264d26137e'
    
      33            '0626cc86232f75a7286c24c52d6b44260bba55e2e96c17fa22ed36decb61a4d9'
    
      34            '99e3cc1da20a751049144cc02dec77174a55109b5b5960e1facd78709da7724f'
    
      35            '0e7d333bfdf9ebb903d40ec4e8b9fe16c75e34d17f9e67cf22646992574a4d77'
    
      36            '2c3b3fa378c86307223b9977c6b07ec1781d5b396c1526ee7fef73b7604a0c6d')
    
      37
    
      38prepare() {
    
      39  cd "${srcdir}/${_pkgbase}/open-vm-tools/"
    
      40  patch -Np1 -i ../../open-vm-tools-gcc16.patch
    
      41  patch -Np1 -i ../../clipway.patch
    
      42  autoreconf -vi
    
      43}
    
      44
    
      45build() {
    
      46  cd "${srcdir}/${_pkgbase}/open-vm-tools/"
    
      47
    
      48  sh ./configure \
    
      49    --prefix=/usr \
    
      50    --sbindir=/usr/bin \
    
      51    --sysconfdir=/etc \
    
      52    --with-udev-rules-dir=/usr/lib/udev/rules.d \
    
      53    --without-kernel-modules
    
      54  make
    
      55}
    
      56
    
      57check() {
    
      58  cd "${srcdir}/${_pkgbase}/open-vm-tools/"
    
      59
    
      60  make check
    
      61}
    
      62
    
      63package() {
    
      64  cd "${srcdir}/${_pkgbase}/open-vm-tools/"
    
      65
    
      66  make install DESTDIR="${pkgdir}"
    
      67  chmod 7755 "${pkgdir}"/usr/bin/vmware-user-suid-wrapper
    
      68
    
      69  # install vmware-xdg-detect-de
    
      70  install -D -m0755 scripts/common/vmware-xdg-detect-de "${pkgdir}"/usr/bin/vmware-xdg-detect-de
    
      71
    
      72  # install pam configuration
    
      73  install -D -m0644 "${srcdir}"/vmtoolsd.pam "${pkgdir}"/etc/pam.d/vmtoolsd
    
      74
    
      75  # install systemd files
    
      76  install -D -m0644 "${srcdir}"/vmtoolsd.service "${pkgdir}"/usr/lib/systemd/system/vmtoolsd.service
    
      77  install -D -m0644 "${srcdir}"/vmware-vmblock-fuse.service "${pkgdir}"/usr/lib/systemd/system/vmware-vmblock-fuse.service
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 17:58:31	LOW	3
2026-07-16 17:52:43	MEDIUM	2